1990 matches found
CVE-2024-45809
Envoy CVE-2024-45809 describes a crash in the Jwt filter when remote JWKs are used and the route cache is cleared (clear_route_cache) while header operations can modify requests (e.g., header to claims). The root cause is the incorrect ordering of continueDecoding and clearRouteCache in upstream ...
CVE-2024-45809 Jwt filter crash in the clear route cache with remote JWKs in envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clearroutecache is enabled on the provider; 3. header...
CVE-2024-45809 Jwt filter crash in the clear route cache with remote JWKs in envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clearroutecache is enabled on the provider; 3. header...
CVE-2024-45810 Envoy crashes for LocalReply in http async client
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling sendLocalReply under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the sendLocalReply in http async client, one...
CVE-2024-45810 Envoy crashes for LocalReply in http async client
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling sendLocalReply under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the sendLocalReply in http async client, one...
CVE-2024-45810
CVE-2024-45810 affects Envoy. The vulnerability is a crash in the HTTP async client when handling sendLocalReply under certain conditions (e.g., websocket upgrade or request mirroring). Root causes described include duplicate status code handling and destructor-order issues in the async stream, l...
CVE-2024-45810 Envoy crashes for LocalReply in http async client
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling sendLocalReply under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the sendLocalReply in http async client, one...
CVE-2024-7207
Rejected reason: Duplicate of CVE-2024-45806...
CVE-2024-7207
CVE-2024-7207 is rejected as a duplicate and does not represent an active vulnerability entry.
PT-2024-31788
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2 Description: A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content...
Envoy 缓冲区错误漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A buffer error vulnerability exists in versions prior to Envoy 1.32.0 that stems from Envoy crashing when the http async client handles sendLocalReply under certain circumstances...
Envoy 安全漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in Envoy version 1.31, which stems from a flaw in the HTTP/2 codec around stream management that can cause Envoy to crash...
PT-2024-31787 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy versions 1.31 through 1.31.1 Description: Envoy is a cloud-native high-performance edge/middle/service proxy. In version 1.31, Envoy is using oghttp as the default HTTP/2 codec, and there are potential bugs around stream management in t...
Envoy 缓冲区错误漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A buffer error vulnerability exists in versions prior to Envoy 1.29, which stems from a Jwt filter that causes Envoy to crash when clearing the routing cache using a remote JWK...
Envoy 安全漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in versions prior to Envoy 1.32.0 that stems from allowing an external client to manipulate the Envoy header, which can lead to unauthorized access or other malicious operations with...
PT-2024-38168 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: A flaw was found in Envoy, allowing modification or manipulation of headers from external clients when pass-through routes are used for the ingress gateway. This issue could enable a maliciou...
编号撤回
Envoy is an Enphase open source gateway program for connecting smart home devices. This CVE number has been withdrawn...
Envoy 安全漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in Envoy version 1.32.0, which stems from a vulnerability that allows an attacker to inject unexpected content into the access log by exploiting insufficient validation of the...